corsair 0.1.149 → 0.1.151

package/dist/{browser-delivery-D9B1ljAd.d.ts → browser-delivery-tqFM2jpE.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-cpdyBUZ9.js';
+import { B as BrowserDeliveryPayload } from './index-C4Q-Nj2c.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-JAIV6R7Z.js

@@ -0,0 +1,68 @@
+import{a as Se,b as Sr,c as _r}from"./chunk-6IURNA4L.js";import{a as vi,b as Ri,c as Ai,d as Fn}from"./chunk-XCTHEKDP.js";import{A as un,B as Ir,C as Bi,a as Si,b as _e,c as _i,d as v,e as J,f as Ei,g as te,h as K,i as _,j as Oi,k as ut,l as Mi,m as lt,n as he,o as be,p as re,r as dt,s as $e,t as ke,u as Ln,v as Di,w as pt,x as Hi,y as Nn,z as Ui}from"./chunk-WUEWJTDA.js";import{b as xi,c as Ii}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as Sp,ZodDate as _p,ZodEnum as Ep,ZodNullable as Op,ZodNumber as Mp,ZodObject as Dp,ZodOptional as Hp,ZodRecord as Up,ZodString as Bp,ZodType as Fp}from"zod";var gt=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","akta","alchemy","algolia","alibaba","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","apollo","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","benzinga","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blackbaud","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","builtwith","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","bytedance","byteforms","cal","callpage","calendly","callingly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","celigo","certifier","chaser","chatbotkit","chatfai","chatwork","chmeetings","cincopa","circleci","claidai","classmarker","clay","clickhouse","clickmeeting","clickup","clicksend","clientary","clockify","close","cloro","cloudcart","cloudflare","cloudflareapikey","cloudinary","coassemble","codeinterpreter","coda","cody","coinbase","coinmarketcal","collegefootballdata","composio","confluence","connecteam","contactout","contentfulgraphql","contextdev","contextsevenmcp","convex","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","cuttly","dadataru","daffy","databricks","datadog","dataforseo","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docmosis","docupost","docsumo","docusign","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","fixer","flexisign","flutterwave","formbricks","fundable","gemini","giphy","github","gitlab","gladia","gmail","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","humanitix","hunterio","imagior","imejisio","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","keenable","kibana","kling","leexi","linear","linkedin","litescrape","loyverse","magichour","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","minimax","monday","mrscraper","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","octen","ollama","onedrive","onepassword","openai","openrouter","openweathermap","orbit","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","pdl","perplexityai","phantombuster","pinecone","plain","ploid","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","remoet","replicate","removebg","replicate","replyio","resend","retailed","revai","rootly","runpod","salesforce","saperly","sapsuccessfactors","scaleai","scrapegraphai","search1api","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","slackbot","snapchat","sourcegraph","spoki","spotify","starton","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","suzanne","surf","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinypng","tinyfish","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","turso","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","updownio","uploadcare","vapi","vaquill","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whautomate","whoisfreaks","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","writer","xero","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],Fi={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",akta:"Akta",alchemy:"Alchemy",algolia:"Algolia",alibaba:"Alibaba Cloud Model Studio",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",apollo:"Apollo",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",benzinga:"Benzinga",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blackbaud:"Blackbaud",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",builtwith:"BuiltWith",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",bytedance:"ByteDance",byteforms:"ByteForms",cal:"Cal",callpage:"CallPage",calendly:"Calendly",callingly:"Callingly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",celigo:"Celigo",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chatwork:"Chatwork",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",claidai:"Claid.ai",classmarker:"ClassMarker",clay:"Clay",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clickup:"ClickUp",clicksend:"ClickSend",clientary:"Clientary",clockify:"Clockify",close:"Close",cloro:"cloro",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",coassemble:"Coassemble",codeinterpreter:"CodeInterpreter",coda:"Coda",cody:"Cody",coinbase:"Coinbase",coinmarketcal:"Coinmarketcal",collegefootballdata:"College Football Data",composio:"Composio",confluence:"Confluence",connecteam:"Connecteam",contactout:"ContactOut",contentfulgraphql:"Contentful GraphQL",contextdev:"Context.dev",contextsevenmcp:"Context7",convex:"Convex",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",cuttly:"Cutt.ly",dadataru:"Dadataru",daffy:"Daffy",databricks:"Databricks",datadog:"Datadog",dataforseo:"DataForSEO",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docmosis:"Docmosis",docupost:"Docupost",docsumo:"Docsumo",docusign:"DocuSign",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",fixer:"Fixer",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",fundable:"Fundable",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",humanitix:"Humanitix",hunterio:"Hunter.io",imagior:"Imagior",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",keenable:"Keenable",kibana:"Kibana",kling:"Kling",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",litescrape:"LiteScrape",loyverse:"Loyverse",magichour:"Magic Hour",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",minimax:"MiniMax",monday:"Monday",mrscraper:"MrScraper",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",octen:"Octen",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",orbit:"Orbit",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",pdl:"People Data Labs",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",ploid:"Ploid",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",remoet:"Remoet",removebg:"remove.bg",replicate:"Replicate",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",revai:"RevAI",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",saperly:"Saperly",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",search1api:"Search1API",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",slackbot:"Slackbot",snapchat:"Snapchat",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",starton:"Starton",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",suzanne:"Suzanne",surf:"Surf",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinypng:"TinyPNG",tinyfish:"TinyFish",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",turso:"Turso",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",updownio:"Updown.io",uploadcare:"Uploadcare",vapi:"Vapi",vaquill:"Vaquill",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whautomate:"Whautomate",whoisfreaks:"Whoisfreaks",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",writer:"Writer",xero:"Xero",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Ee(e){let n=Fi[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var we=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function D(e){return typeof e=="string"&&e.length>0}function Nc(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function $c(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function ft(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!D(n.connectUrl)||!D(n.token)||!D(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:D(n.environmentId)?n.environmentId:n.projectId};return D(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function yt(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!D(r.tenantId)||!D(r.plugin)||!Nc(r.status)||!$c(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:D(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function mt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!D(n.approvalUrl)||!D(n.token)||!D(n.projectId)||!D(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function ln(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(D(n.access_token))return{access_token:n.access_token,refresh_token:D(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:D(n.scope)?n.scope:void 0};throw new Error(D(n.error)?D(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Wc(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function qc(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;D(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function jc(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function Li(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!D(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!D(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=qc(o.fields),s=Wc(o.missingRequiredFields),c=jc(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:D(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function Er(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Ni(e,n,t){if(n===404&&t)return t;let r=Er(e);if(!r)return`Hub API returned HTTP ${n}`;if(!e||typeof e!="object")return r;let o=e,i=[r];if(typeof o.code=="string"&&o.code.length>0&&i.push(`Hub error code: ${o.code}`),typeof o.hint=="string"&&o.hint.length>0&&i.push("",o.hint),Array.isArray(o.fix)){let a=o.fix.filter(s=>typeof s=="string"&&s.trim().length>0);if(a.length>0){i.push("","What to do:");for(let s of a)i.push(`- ${s}`)}}if(o.received!==void 0)try{i.push("",`Hub received: ${JSON.stringify(o.received)}`)}catch{}if(o.details!==void 0)try{i.push("",`Details: ${JSON.stringify(o.details)}`)}catch{}return typeof o.creditsRequired=="number"&&i.push("",`Credits required for this call: ${o.creditsRequired}`),i.join(`
+`)}function $i(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}var Wi="0.1.151";function Kc(){return{"x-corsair-sdk-version":Wi}}function ht(e){return e.replace(/\/$/,"")}function Or(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Se()}catch{return null}}function qi(e){let n=Or(e);return n?{"x-corsair-delivery-url":n}:{}}function ji(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function Ki(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Zc(e,n,t){return Ni(e,n,t)}function Zi(e,n,t){let r=$i(e);throw r?new we({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Zc(e,n,t))}async function S(e){let n=ht(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...qi(e.hub),...ji(e.hub),...Kc(),...e.extraHeaders},body:JSON.stringify(e.body)}),r=await Ki(t);return t.ok||Zi(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function Z(e){let n=ht(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...qi(e.hub),...ji(e.hub)}}),r=await Ki(t);return t.ok||Zi(r,t.status,e.notFoundMessage),e.parseResponse(r)}function bt(e){return e&&typeof e=="object"?e:{}}function Gi(e){let n=bt(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Mr(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=bt(t);return{chat:r.thread,reply:Gi(r.reply)}}})}async function Dr(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Gi})}async function Hr(e,n){return Z({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=bt(t).threads;return Array.isArray(r)?r:[]}})}async function Ur(e,n){return Z({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=bt(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Xc}from"crypto";var Gc="corsair:client-bridge";function Br(e){return new URL(e).origin}function dn(e){let n=JSON.stringify({type:Gc,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Br(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var zc=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Fr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:zc.has(n)}catch{return!1}}function $n(e){return e==="development"?"browser":"server"}function zi(e){return $n(e)==="browser"}function Ji(e){return Fr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Qc}from"crypto";var Oe=60*1e3,We=300*1e3;import{createHmac as Jc,randomBytes as Vc,timingSafeEqual as Yc}from"crypto";function Ce(){return Vc(16).toString("base64url")}function Wn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Jc("sha256",t).update(e).digest("base64url")}function ue(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=Wn(o,t);try{if(!Yc(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function kt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=Wn(i,n);return`${i}.${a}`}function qn(e,n,t){let r=Math.floor(Date.now()/1e3);return kt(e,n,r+Math.floor(t/1e3))}function qe(e){return decodeURIComponent(e)}function Lr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Vi(e){let n=e.trim();return n.length>0?n:null}function pn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function gn(e,n){if(!Vi(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Qc(16).toString("base64url"),iat:t,exp:t+Math.floor(Oe/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Wn(o,n);return`${o}.${i}`}function Me(e,n){return Vi(n)?ue(e,n):null}function eu(e){let n=Br(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function Nr(e){let n=gn(eu(e),e.signingSecret);return pn(e.deliveryUrl,n)}function Yi(e){if($n(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Xc(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:Nr(r)}}var jn="https://auth.corsair.dev";var Te=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Kn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function $r(e){let n=(e.apiUrl?.trim()||jn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new Kn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel,runtimeProofKey:e.runtimeProofKey?.trim()||void 0}}function wt(e){return $r(e)}function nu(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function $(e){let n=v(e).hub;if(!n||!nu(n))throw new Te;return n}function Qi(e){return e.replace(/\/$/,"")}function Ct(e){return e.oauthCallbackUrl?Qi(e.oauthCallbackUrl.trim()):`${Qi(e.apiUrl)}/oauth/callback`}function fn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}function Xi(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var Wr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function W(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...K[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:Wr(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},l=null,u=async()=>{if(l)return l;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await re(b.dek,r),l},d=async()=>{let b=await c.getIntegration(),k=await u(),P=b.config;return!P||Object.keys(P).length===0?{}:ke(P,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await u(),P;try{P=await d()}catch(E){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,E),P={}}let R={...P};for(let[E,ee]of Object.entries(b))ee===null?delete R[E]:R[E]=ee;let U=$e(R,k);await c.updateIntegration({config:U})};return{get_dek:u,issue_new_dek:async()=>{let b=await c.getIntegration(),k=he(),P={};if(b.dek){let U=await re(b.dek,r),E=b.config;E&&Object.keys(E).length>0&&(P=Ln(E,U,k))}let R=await be(k,r);return await c.updateIntegration({config:P,dek:R}),l=k,k},...Xi(d,g,a)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...K[n].account,...a],l=null,u=async()=>{if(l)return l;let C=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!C&&s){C=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:T.id,config:Wr(T.config),dek:T.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:u,getAccount:async()=>{let C=!1;for(;;){let T=await u(),O=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!O){if(!C&&s){C=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:O.id,config:Wr(O.config),dek:O.dek??null}}},updateAccount:async C=>{let T=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...C.config!==void 0?{config:C.config}:{},...C.dek!==void 0?{dek:C.dek}:{},updated_at:new Date}).where("id","=",T.id).execute()}},p=null,g=null,f=null,h=async()=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===C.dek||(p=await re(C.dek,o),g=C.dek),p},b=async()=>{if(f)return f;let C=await d.getIntegration();if(!C.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await re(C.dek,o),f},k=async()=>{let C=await d.getAccount(),T=await h(),O=C.config;return!O||Object.keys(O).length===0?{}:ke(O,T)},P=async()=>{let C=await d.getIntegration(),T=await b(),O=C.config;return!O||Object.keys(O).length===0?{}:ke(O,T)},R=Promise.resolve(),U=C=>{let T=R.then(()=>E(C));return R=T.catch(()=>{}),T},E=async C=>{let T=await d.getAccount();if(!T.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let O=await re(T.dek,o),L;try{let M=T.config;L=!M||Object.keys(M).length===0?{}:ke(M,O)}catch(M){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,M),L={}}let ne={...L};for(let[M,Ie]of Object.entries(C))Ie===null?delete ne[M]:ne[M]=Ie;let H=$e(ne,O);await d.updateAccount({config:H})},ee={get_dek:h,issue_new_dek:async()=>{let C=await d.getAccount(),T=he(),O={},L=null;if(C.dek){L=await re(C.dek,o);let H=C.config;H&&Object.keys(H).length>0&&(O=Ln(H,L,T))}let ne=await be(T,o);if(L){let H=L;await i.db.transaction().execute(async M=>{await Ui(M,C.id,H,T),await M.updateTable("corsair_accounts").set({config:O,dek:ne,updated_at:new Date}).where("id","=",C.id).execute()})}else await d.updateAccount({config:O,dek:ne});return p=T,g=ne,T},...Xi(k,U,c)};return n==="oauth_2"&&(ee.get_integration_credentials=async()=>{let C=await P();return{...C,client_id:C.client_id||null,client_secret:C.client_secret||null,redirect_url:C.redirect_url??null}}),ee}async function es(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=he(),i=await be(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ns(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=he(),s=await be(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var tu=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function De(e){return tu.has(e)}function ru(e,n){return De(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ou(e){return!De(e)}function iu(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function su(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function au(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!iu(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function ts(e,n){if(!e)return!1;let t=te(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function cu(e,n){let r=e.authConfig?.[n]?.integration??[];return[...K[n].integration,...r]}function uu(e,n){let r=e.authConfig?.[n]?.account??[];return[...K[n].account,...r]}function lu(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:au(n,t),fields:t,missingRequiredFields:r}}async function je(e,n,t){let r=_(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=W({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),u=cu(n,r),d=uu(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:ru(r,g),configured:await ts(c,g)});for(let g of d)p.push({name:g,level:"account",required:ou(g),configured:await ts(l,g)});if(su(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return lu(n.id,r,p)}async function Zn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await je(e,a,r);s&&i.push(s)}return i}function Tt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var rs=Symbol.for("corsair:internal"),os=new WeakMap,is=new WeakMap;function du(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function pu(e){if(e.database){let t=os.get(e.database);return t||(t=new Map,os.set(e.database,t)),t}let n=is.get(e);return n||(n=new Map,is.set(e,n)),n}function gu(e){return e.multiTenancy?{withTenant:()=>({}),[rs]:e}:{[rs]:e}}async function yn(e,n){if(!e.database)return;let t=n.trim()||"default",r=pu(e),o=du(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-V3Y7452F.js");await s(gu(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Gn from"crypto";function He(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function qr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function mn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Gn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var jr=600*1e3;function Pt(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Gn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Gn.timingSafeEqual(a,s)?null:qr(r,{maxAgeMs:jr})}function ss(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function as(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function hn(e,n){await S({hub:e,path:"/connections/report",body:ss(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function fu(e,n){try{let t=$(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Te)return}}async function yu(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!_(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await je(n,e.plugin,r);o&&us(e.hub,as({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function cs(e,n){fu(e,n)}function us(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function bn(e){yu(e).catch(()=>{})}async function Pe(e,n){let t=v(e);if(!_(n.plugin))return;let o=await je(t,n.plugin,n.tenantId);o&&cs(e,as({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function vt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var ls=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function mu(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function hu(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await re(n.dek,e.kek),r=ls(n.config),o={};Object.keys(r).length>0&&(o=ke(r,t)),o[e.link.linkType]=e.link.externalId;let i=$e(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function kn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await mu({database:n,pluginId:r,tenantId:o}),l=!1;if(a){let u=B({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await hu({database:n,kek:t,accountId:c,link:i})}async function Kr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await re(s.dek,t),u=ls(s.config)[o];if(!u)continue;if(dt(u,c)===i)return s}catch{continue}return null}async function Rt(e){return(await Kr(e))?.tenant_id??null}async function ds(e){return Rt({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as ps from"querystring";function Ke(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${ps.stringify(i)}`}async function gs(e,n){try{return await Z({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function wn(e,n,t,r){if(!n.subscribe)return;let o=$(e),i=await gs(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await Pe(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var V=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function fs(e){let n=e.oauthConfig;if(!n)throw new V("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function bu(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=he(),l=await be(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:un(),created_at:u,updated_at:u,tenant_id:t,integration_id:a.id,config:{},dek:l}).execute()})}async function Zr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=v(e,()=>new V("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=J(a,n,p=>new V("plugin_not_found",p)),c=fs(s),u=await W({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Ke({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=mn(He(n,r),a.kek);return{url:Ke({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function ku(e,n){return{...n??{},...e}}async function zn(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new V("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new V("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=Pt(r,i.kek);if(!h)throw new V("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new V("no_database","No database configured on corsair instance");let c=J(i,a,h=>new V("plugin_not_found",h)),l=fs(c),u=W({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new V("credentials_not_configured",`Credentials not configured for '${a}'`);await bu(i.database,a,s,i.kek);let g=await At(t,d,p,l,o);if(!g.access_token)throw new V("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await Pe(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=ku(g,n.callbackParams),b=await vt(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await kn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&hn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await wn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function wu(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??wn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(u=>u.id===s.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${s.tenantId}`;try{let u=_(c)??"oauth_2",d=B({authType:u,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),a.push(l)}}return{renewed:i,failed:a}}async function ys(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return wu({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function Cu(e,n={}){let t=!1,r=()=>{t||(t=!0,ys(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function ms(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await xt(e,{silent:!0})}async function Cn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(t,n)}var Tu=Symbol.for("corsair:internal"),Pu=new Set(["access_token","refresh_token","expires_at","scope"]);function vu(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ru(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!De(t)&&!Pu.has(t)):n.filter(t=>!De(t))}function hs(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Au(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function xu(e){return{[Tu]:hs(e)}}async function It(e,n,t={}){let r=Ct(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=hs(e),s=xu(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=_(c);if(!l)continue;let u=vu(l),d=t.providerNameOverrides?.[c.id]??Ee(c.id),p=await je(a,c,n),g=ut(c,l),f=Ru(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let P=await Zr(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=P.url}catch(P){P instanceof Error&&/client_id not configured/i.test(P.message)||(h.setupError=P instanceof Error?P.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function dy(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return It({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function bs(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(e.internalConfig??Au(e),n)}async function ks(e,n){await Cn(e,n)}async function ws(e,n){let t=fn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:ft})}async function Cs(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await bs(t,n.tenantId);let r=await It(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return ws(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function St(e,n){let t=v(e),r=$(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await ks(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await It(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return ws(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function _t(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Iu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Iu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-3TLOP2YN.js"),{postHubConnectSession:i}=await import("./connect-3Q43KWY5.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function Tn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ie=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Su(e){let n=e.oauthConfig;if(!n)throw new ie("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Gr(e,n){let t=v(e,()=>new ie("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ie("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ie("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Pt(n,t.kek);if(!o)throw new ie("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=J(t,i,p=>new ie("plugin_not_found",p)),c=Su(s),u=await W({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new ie("client_id_not_configured",`client_id not configured for '${i}'`);let d=Ke({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Eu}from"async_hooks";import{randomBytes as Ou}from"crypto";import{v4 as Mu}from"uuid";var le=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function Et(e,n){let t=fn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:mt})}function Ot(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var zr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Vr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Ts(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Jr(e){return Ot(e)}async function Yr(e,n){if(Vr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Ts(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Et(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:_u(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function _u(e){try{return JSON.parse(e)}catch{return e}}async function Mt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Yr(e,n);return{...n,approvalUrl:r}}async function Qr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await Yr({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:l,expires_at:u});return Vr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Jr(g):zr:r?g?Jr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:zr}var Dt=new Eu,Ps={open:0,cautious:1,strict:2,readonly:3},Pn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function Xr(e,n){return e===void 0?n:n===void 0||Ps[e]>=Ps[n]?e:n}function Ht(e,n){return Dt.run(Xr(Dt.getStore(),e)??e,n)}function vn(){return Dt.getStore()}function eo(e){return Ht("readonly",e)}function As(){return Dt.getStore()==="readonly"}function Ut(e,n){if(As()&&n!=="read")throw new Pn(e,n)}function Ze(e,n){Ut(e,n);let t=vn();if(!(t===void 0||Bt(n,t)==="allow"))throw new le(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var Du={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},vs={allow:0,require_approval:1,deny:2};function xs(e,n){return e===void 0?n:vs[e]>=vs[n]?e:n}function Bt(e,n,t){return t!==void 0?t:Du[n][e]}function no(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Is(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Rs(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Ss(e){let n=Bt(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Rs(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=Mu(),l=Ou(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Rs(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function x(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function de(e){let n={error:e.code,message:e.message,...e.extra};return x(e.status,n)}function Ue(e){return new w(404,"not_found",e)}function F(e,n={}){return new w(400,"bad_request",e,n)}function to(e,n){return J(e,n,t=>Ue(t))}async function _s(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=W({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=K[t].integration,i=r,a;try{a=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{a=o.map(()=>null)}let s=o.filter((l,u)=>a[u]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function Es(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await _s(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Ft(){return{ok:!0}}async function Rn(e){return Promise.all(e.plugins.map(n=>Es(n,e)))}async function Lt(e,n){let t=to(e,n);return Es(t,e)}async function Hu(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Os(e,n){let t=await Hu(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function An(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Nt(e,n){if(!n)throw F("Tenant id must be a non-empty string");return Os(e,n)}async function $t(e,n){let t=n?.id?.trim();if(!t)throw F("Tenant id is required",{missingFields:["id"]});return Os(e,t)}async function Wt(e,n){let t=n?.trim()||"default",r={},o=await Zn(e,t);for(let i of o)r[i.plugin]=Tt(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function qt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw F("plugin is required",{missingFields:["plugin"]});let r=t.trim();to(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw F("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let u=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await l.deleteFrom("corsair_events").where("account_id","in",u).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",u).execute(),c=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function ro(e,n){if(!e.database)throw Ue(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Ue(`Permission '${n}' not found`);return Mt(e,t)}function Uu(e){if(!e.oauthConfig)throw F(`Plugin '${e.id}' has no oauthConfig`)}function Bu(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function oo(e){let n=Bu(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function Fu(e){let n=!!e.hub,t=Tn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function Ms(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function Lu(e,n){let t=n?.plugin?.trim();if(!t)throw F("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=to(e,t);Uu(o);let i=oo(e);Ms(e);let a=await _s(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=mn(He(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+jr).toISOString(),tenantId:r}}async function Nu(e,n,t){Ms(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await St(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function jt(e,n,t){return Fu(n),n.hub?Nu(e,n,t):Lu(n,t)}async function Kt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw F("state is required",{missingFields:["state"]});oo(n);try{return await Gr(e,r)}catch(o){if(o instanceof ie)switch(o.code){case"invalid_state":throw F("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Zt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw F("Missing required fields",{missingFields:i});let a=oo(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw F("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function io(e,n){if(!e.database)throw Ue("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Ue("Permission not found");return Mt(e,t)}async function Ds(e,n){return"id"in n?ro(e,n.id):io(e,n.token)}import{createCipheriv as zu,createDecipheriv as hm,randomBytes as Fs,scryptSync as Ju}from"crypto";import{createHmac as so,randomUUID as $u,timingSafeEqual as Us}from"crypto";function ao(e){return e.run??null}function co(e){return e.probe??null}function Bs(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function Gt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=so("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":$u()}}}function uo(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Bs(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>We)return!1;let i=so("sha256",n).update(e.body).digest("hex");try{return Us(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function xn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Bs(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>We)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=so("sha256",n).update(e.body).digest("hex");try{if(!Us(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function In(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function zt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function Jt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Jn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function lo(e){return Jn(In(e))}async function po(e){let n=await Qt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=In(n.body),r=zt({httpOk:n.ok,status:n.status,body:t}),o=Jn(t);if(!r||!o)throw new Error(Yt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function Vt(e){return Jt(In(e))}function Wu(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Hs(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var qu="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",ju="Check the delivery URL configured for this environment.";function Ku(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${qu}`}function Zu(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${ju}`}function Vn(e,n){let t=Wu(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function Yt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Vn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return Ku(e);if(e.status===404)return Zu(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Hs(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Hs(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var Gu=15e3;async function Qt(e){let{body:n,headers:t}=Gt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(Gu)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Vn(e.deliveryUrl,r)}}}var Vu="aes-256-gcm",Yu=12,Qu=16,Xu=16,el=32;function nl(e,n){return Ju(e.trim(),n,el)}function go(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=Fs(Xu),o=nl(t,r),i=Fs(Yu),a=zu(Vu,o,i,{authTagLength:Qu}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),l=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var tl=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function fo(e){if(e instanceof Si)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!tl.some(t=>n.includes(t))}function rl(e){if(!e)return[];let n=_(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!De(r)):[]}async function Yn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await xt(e,{silent:!0});let[r,o]=await Promise.all([An(t),Rn(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=rl(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return go(i,n)}var pe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function Xt(e,n){let t=v(e,()=>new pe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new pe("no_database","Database not configured");let r=J(t,n.plugin,u=>new pe("plugin_not_found",u)),o=_(r);if(!o)throw new pe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new pe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Cn(e,n.tenantId);let i=new Set(ut(r,o)),s=r.authConfig?.[o]?.account??[],c=B({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new pe("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=te(c,`set_${u}`);if(!p)throw new pe("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new pe("invalid_credentials","Provide at least one credential field to save");return await Pe(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ge=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function yo(e,n){let t=v(e,()=>new ge("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ge("no_database","Database not configured");let r=J(t,n.plugin,u=>new ge("plugin_not_found",u)),o=_(r);if(!o)throw new ge("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await ms(e);let i=new Set(Mi(r,o)),s=r.authConfig?.[o]?.integration??[],c=W({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ge("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=te(c,`set_${u}`);if(!p)throw new ge("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ge("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var er=new Map;function ol(e){for(let[n,t]of er)t<=e&&er.delete(n)}function nr(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();ol(r);let o=er.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(er.set(t,r+n),{ok:!0})}var Be=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Sn(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Be("no_access_token","Managed OAuth delivery missing access_token");let u=v(e,()=>new Be("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Be("no_database","No database configured on corsair instance");let d=J(u,t,g=>new Be("plugin_not_found",g));await Cn(e,r);let p=B({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await Pe(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await vt(u.plugins,t,{access_token:o,refresh_token:i,scope:s,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await kn({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&hn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await wn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function il(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Ls(e,n,t=[]){for(let[r,o]of Object.entries(e))if(il(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=Ls(o,n,[...t,r]);if(i)return i}return null}function sl(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function al(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Ns(e,n,t,r,o){let i=sl(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=al(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:gt;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=Ls(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let P=await h.webhook.handler(k),R=!!Object.keys(P.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:R?{...P?.returnToSender,success:!0}:{success:!0},...P.responseHeaders&&{responseHeaders:P.responseHeaders}}}catch(P){return console.error(`Error executing webhook handler for ${g}.${b}:`,P),{plugin:g,action:b,body:a,response:{success:!1,error:P instanceof Error?P.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as cl}from"crypto";import*as Ge from"vm";var $s="__corsairFailedStep",ul=3e4,mo=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Ws(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function qs(e,n){return`st_${cl("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function tr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var js=new Set(["constructor","prototype","__proto__"]);function ve(e,n){if(e===null)return null;let t=typeof e;return t==="function"?dl(e,n):t==="object"?ll(e):e}function ll(e){return new Proxy(e,{get(n,t){if(!js.has(t))return ve(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function dl(e,n){return new Proxy(e,{apply:(t,r,o)=>pl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!js.has(r))return ve(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function pl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>ve(n,void 0),n=>{throw ve(n,void 0)}):ve(e,void 0)}function gl(e){let n=Object.create(null),t=Ge.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ge.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ge.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ge.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=ve(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let l=Ge.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function ho(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,l=qs(a,c);if(Object.hasOwn(n,l))return ve(n[l].output,void 0);try{let u=await s();return t.push({stepId:l,name:a,seq:c,status:"completed",output:u}),u}catch(u){if(Ws(u))throw u;let d=tr(u);t.push({stepId:l,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[$s]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,l=qs(a,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:a,seq:c,status:"completed",output:null});let u=Number.isFinite(s)?Math.max(0,s):0;throw o=new mo(Date.now()+u,a),o};try{await gl({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??ul});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(Ws(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=tr(a),c=a!==null&&typeof a=="object"?a[$s]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as rr from"vm";var Ks=1e4;async function bo(e){let n=Object.create(null),t=rr.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=ve(e.corsair,void 0);let r=yl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await eo(()=>{let a=rr.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((l,u)=>{s=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:fl(i)}}catch(i){return{status:"error",error:tr(i)}}}function fl(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function yl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?Ks:Math.min(e,Ks)}function ze(e){return e.deliveryMode==="auth.credentials"}function Qn(e){return e.deliveryMode==="connections.sync"}function or(e){return e.deliveryMode==="connect.create_link"}function Xn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function et(e){return e.deliveryMode==="oauth.tokens"}function ir(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!ze(e)&&!Qn(e)&&!or(e)&&!Xn(e)&&!et(e)}function ml(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function hl(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Yn(e,n)}}}}}catch(t){return{status:"failed",retryable:fo(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function bl(e,n){try{let t=await _t(e,n);return ml(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function ko(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function kl(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Rt({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function wl(e,n,t,r){let o=await kl(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await Ns(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function Cl(e,n){return await zn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function Tl(e,n){return await Sn(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function Co(e,n,t){let r=await wo(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function wo(e,n,t){let r=v(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Pl(e,n){try{return await Xt(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function vl(e,n){try{return await yo(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function Zs(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function Rl(e,n){try{let t=Zs(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await ho({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function Al(e,n){try{let t=Zs(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await bo({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function nt(e,n,t={}){let r=v(e),o=ko(n.headers,"x-corsair-signature"),i=ko(n.headers,"x-corsair-timestamp"),a=ko(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let l=xn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=nr(`nonce:${a.trim()}`,We);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return wl(e,r,c.payload,s);case"oauth.callback":return Cl(e,c.payload);case"oauth.tokens":return Tl(e,c.payload);case"permission.approve":return wo(e,c.payload,"approved");case"permission.deny":return wo(e,c.payload,"denied");case"auth.credentials":return Pl(e,c.payload);case"integration.credentials":return vl(e,c.payload);case"connect.create_link":return bl(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?hl(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?Rl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?Al(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function xl(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var To=3,Il=250;function Sl(e){return e?.name==="AbortError"}async function _l(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function El(e,n,t,r,o){for(let i=1;i<=To;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await _l(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(Sl(a))throw a}i<To&&await zs(Il)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${To} attempts; the run may be retried`),!1}async function Ol(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=xl(l);return await El(n,t,o,{deliveryId:a,status:u,body:d},r)?"handled":"error"}var Gs=1e3,Ml=5e3,Dl=3e4;function zs(e){return new Promise(n=>setTimeout(n,e))}var sr=globalThis.__corsairConnectLoops??=new Map;function Hl(e,n={fetch,process:nt}){let t;try{t=$(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(sr.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");sr.set(r,o);let i=()=>{sr.get(r)===o&&sr.delete(r)},a=!1,s=null;return(async()=>{let l=Gs,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),a||await zs(l),l=Math.min(l*2,Ml)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),Dl);try{await Ol(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(u=!1,l=Gs)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function Js(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ul(e,n){return n&&!n.has(e.id)?!1:_(e)!==null}async function Vs(e,n,t={}){let r=v(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Zn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>Ul(l,i)).map(l=>{let u=_(l),d=s.get(l.id);return d?{plugin:l.id,providerName:Ee(l.id),authKind:Js(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Ee(l.id),authKind:Js(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function Ys(e,n){let t=$(e);return Z({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:yt})}function Bl(e){return typeof e=="string"&&e.length>0}function ar(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!Bl(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};return n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),t}var Qs=1024*1024,Xs=3e4;function Je(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:Qs}function Ve(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:Xs}function _n(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function Fl(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function cr(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(Fl(n)),n)})])}finally{clearTimeout(t)}}async function ur(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await cr(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw _n(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var Po=new Map;function ea(e){let n;try{n=$(e)}catch{return}let t=Or(n);t&&Po.get(n.projectApiKey)!==t&&(Po.set(n.projectApiKey,t),S({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Po.delete(n.projectApiKey)}))}var Ll=[".corsair.dev"];function Nl(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function $l(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Nl(n)?!0:Ll.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function na(e){return!e||!$l(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function ta(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function vo(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Ro(e,n){let t=$(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=Me(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=nr(`browser:${i.jti}`,Oe);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(Qn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await Yn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(or(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await _t(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(ze(i))return i.hubSuccessUrl?i.credentials?(await Xt(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:vo(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:vo(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Xn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await Co(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(et(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Sn(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!ir(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await zn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return Qn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:or(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:ze(i)&&i.hubSuccessUrl?{type:"redirect",url:vo(i.hubSuccessUrl,{error:c})}:ze(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Ao(e,n){let t=$(e),r=await nt(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function xo(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function Io(e,n){return n.method==="GET"?Ro(e,n.url):Ao(e,{headers:n.headers,body:n.body??""})}async function So(e,n){try{let t=await Io(e,n);return xo(t)}catch(t){if(t instanceof Te)return Response.json({error:t.message},{status:503});throw t}}async function Ye(e,n,t){ea(e);let r=n.method.toUpperCase(),o=na(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await So(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await ur(n,{maxBodyBytes:Je(t?.maxBodyBytes),bodyStallTimeoutMs:Ve(t?.bodyStallTimeoutMs)}):void 0});return ta(i,o)}var I=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function En(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function On(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var ra=new WeakMap;function Qe(e,n,t){let r=ra.get(e);r||(r=new Map,ra.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var oa=300;async function _o(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Qe(t,s,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new I(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&l&&Number(l)>d+oa)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!a){let f=l?Number(l):null;if(f===null||f>d+oa)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new I(o,"managed");let p=await ql(r,o,i,u),g=await On(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Wl(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function ql(e,n,t,r){try{return await S({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:ln})}catch(o){let i=o instanceof Error?o.message:"";throw Wl(i)?new I(n,"managed"):o}}async function ia(e,n){e._refreshAuth=async()=>(await _o(n,{forceRefresh:!0})).accessToken}import{createHmac as jl}from"crypto";var Kl="x-corsair-runtime-proof";function sa(e,n){if(!e.runtimeProofKey)return{};let t=Math.floor((n.nowMs??Date.now())/1e3),r=jl("sha256",e.runtimeProofKey).update([t,n.path,n.plugin,n.tenantId,n.operation].join(`
+`)).digest("base64url");return{[Kl]:`t=${t},v1=${r}`}}var Zl="",Gl=60,Eo=new WeakMap;function aa(e){let n=ht(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(Zl)}function zl(e,n,t,r){let i=`${aa(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function Jl(e,n){return Eo.get(e)?.get(n)}function Vl(e,n,t){let r=Eo.get(e);r||(r=new Map,Eo.set(e,r)),r.set(n,t)}function Yl(e,n){return e.expiresAt===null?!1:e.expiresAt>n+Gl}function lr(e,n){if(!n)throw new I(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function Oo(e,n){lr(e.plugin,e.hub);let t=n.operation.trim();if(!t)throw new I(e.plugin,"managed_pricing",`[auth-missing:${e.plugin}:managed_pricing]: Operation id is required for Hub metering.`);let r=n.forceRefresh??!1,o=zl(e.hub,e.plugin,e.tenantId,t),a=`managed_pricing:${r?"force":"routine"}:${o}`;return Qe(e.cache,a,async()=>{let s=Math.floor(Date.now()/1e3);if(!r){let u=Jl(e.cache,o);if(u&&Yl(u,s))return{apiKey:u.apiKey,expiresAt:u.expiresAt,fromCache:!0}}let c=await S({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,operation:t},extraHeaders:{...sa(e.hub,{path:"/managed-pricing/credentials",plugin:e.plugin,tenantId:e.tenantId,operation:t}),"x-corsair-metered-operation":t},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:ar}),l=c.expires_in!==void 0?s+c.expires_in:null;return Vl(e.cache,o,{apiKey:c.api_key,expiresAt:l}),{apiKey:c.api_key,expiresAt:l,fromCache:!1}})}function dr(){return{}}async function pr(e,n){lr(n.plugin,e.hub);let t=e.tenantId?.trim();if(!t)throw new I(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: tenantId is required for metered credentials.`);let r=(n.operation??e.meteredOperationId)?.trim();if(!r)throw new I(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: Endpoint operation id missing \u2014 cannot meter usage.`);return(await Oo({hub:e.hub,plugin:n.plugin,tenantId:t,cache:n.cache},{operation:r})).apiKey}function ca(e){return{delivery:n=>Ye(e,n),deliveryOptions:n=>Ye(e,n)}}var ua=1200*1e3;function Mo(){return Ce()}function Do(){return ua}function Ho(e,n){return qn(e,n,ua)}function Uo(e,n){return ue(e,n)}function Bo(e){return qe(e)}var la=600*1e3;function Fo(){return Ce()}function Lo(){return la}function No(e,n){return qn(e,n,la)}function $o(e,n){return ue(e,n)}function Wo(e){return Lr(e)}function qo(e){return qe(e)}function jo(){return Ce()}function Ko(e,n,t){return kt(e,n,Math.floor(t.getTime()/1e3))}function Zo(e,n){return ue(e,n)}function Go(e){return qe(e)}var Xe=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${lt}`),this.name="CorsairKekMissingError"}};function gr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new Xe;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${lt}`)}})}async function Ql(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function da(e){let{integrationId:n,accountId:t}=await Ql(e);return{integrationId:n,accountId:t}}function pa(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>Mr(t(),{tenantId:n,message:r}),list:()=>Hr(t(),{tenantId:n}),get:r=>({message:o=>Dr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Ur(t(),{chatId:r,tenantId:n})})}}function ga(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Xl(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await Cs(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):ga(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function ed(e,n,t){let r=mn(He(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):ga(e,i),connectUrl:i}}async function nd(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&Tn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?ed(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Xl({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function fa(e){let{message:n,connectUrl:t}=await nd(e);throw new I(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var fr="connect.request",Jo="connect.cleared",td=600*1e3;async function zo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function rd(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function od(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[fr,Jo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function ya(e,n,t,r,o,i,a){if(a&&!i)throw new Error("encryptDataAtRest requires kek");let s=await od(e,n,o),c=new Date(s),l=i?pt(r,await Nn(e.db,n,i)):r;await e.db.insertInto("corsair_events").values({id:un(),created_at:c,updated_at:c,account_id:n,event_type:t,payload:l}).execute()}async function id(e,n,t=Date.now()){let r=await zo(e,n.tenantId,n.plugin);r&&await ya(e,r,fr,{plugin:n.plugin,connectUrl:n.connectUrl},t,n.kek,n.encryptDataAtRest)}function sd(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function ad(e,n,t,r,o,i){let a=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[fr,Jo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!a||a.event_type!==fr)return null;let s=a.created_at instanceof Date?a.created_at.getTime():Date.parse(String(a.created_at));if(r-s>o)return null;let c=a.payload;if(typeof c=="string")try{c=JSON.parse(c)}catch{return null}if(Di(c)){if(!i)return null;try{c=Hi(c,await Nn(e.db,n,i))}catch{return null}}let l=sd(c);if(!l)return null;let u=l.plugin,d=l.connectUrl;return typeof u!="string"||typeof d!="string"?null:{plugin:u,connectUrl:d,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function Vo(e,n,t=Date.now(),r=td,o){let i=await rd(e,n);if(i.length===0)return null;let a=(await Promise.all(i.map(u=>ad(e,u,n,t,r,o)))).filter(u=>u!==null);if(a.length===0)return null;a.sort((u,d)=>u.requestedAtMs-d.requestedAtMs||u.accountId.localeCompare(d.accountId));let{requestedAtMs:s,accountId:c,...l}=a[0];return l}async function ma(e,n,t=Date.now(),r,o,i){let a;if(r)a=await zo(e,n,r);else{let s=await Vo(e,n,t,void 0,o);a=s?await zo(e,n,s.plugin):null}a&&await ya(e,a,Jo,{},t,o,i)}async function Yo(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await id(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl,encryptDataAtRest:n.encryptDataAtRest,kek:n.kek})}catch{}}var cd=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function ha(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||cd)(e,i)}var ba=new Map;function ud(e){let n=ba.get(e);return n||(n=dr(),ba.set(e,n)),n}function ld(e){return typeof e=="function"}function Qo({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:R}){for(let[U,E]of Object.entries(e)){let ee=n?.[U];if(ld(E)){let C=ee,T=[...a,U].join("."),O=async(L={})=>{let ne=l?.[T];Ut(T,ne?.riskLevel??"write");let H,M=vn(),Ie=c?.mode,Hn=Xr(M,Ie);if(Hn){let q=ne,oe=q?.riskLevel??"write",me=c?.overrides?.[T],Ne=M!==void 0&&M!==Ie&&Hn===M?xs(me,Bt(oe,M)):me,{result:an,reason:N,onComplete:Bn,token:ct,id:Pi,expiresAt:Fc}=await Ss({pluginId:o,endpointPath:T,args:L,mode:Hn,override:Ne,riskLevel:oe,meta:q,db:u,timeoutMs:d?no(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(an==="blocked"){let cn;N==="denied"?cn=`Action '${T}' was denied by the user. Await further instructions before proceeding.`:N==="policy"?cn=M?`Action '${T}' is blocked by permission mode '${M}'.`:`Action '${T}' is blocked by the permission policy. Update the corsair config to allow it.`:N==="timeout"?cn=`Action '${T}' timed out waiting for approval.`:ct&&Pi?cn=await Qr({permissionsOptions:d,manual:g,hub:f,permissionId:Pi,permissionToken:ct,plugin:o,endpoint:T,args:L,tenantId:p??"default",expiresAt:Fc??new Date(Date.now()+(d?no(d.timeout):600*1e3)).toISOString(),operationPath:T}):cn=`Action '${T}' requires user approval before it can run.`;let Lc=N==="denied"||N==="policy"||N==="timeout"?N:"pending";throw new le(cn,Lc)}H=Bn}let xr=async(q,oe,me)=>{try{return await E(oe,me)}catch(at){if(at instanceof Error){let Ne=await ha(at,o,T,typeof me=="object"&&me!==null?me:{args:me},i);if(q<(Ne.maxRetries||0)){let an=q+1;console.log(`Retrying (${an} / ${Ne.maxRetries})...`);let N;if(Ne.headersRetryAfterMs)N=Ne.headersRetryAfterMs;else switch(Ne.retryStrategy){case"exponential_backoff":N=Math.pow(2,an-1)*1e3;break;case"exponential_backoff_jitter":let Bn=Math.pow(2,an-1)*1e3,ct=(Math.random()-.5)*1e3;N=Math.max(0,Bn+ct);break;case"linear_1s":N=1e3;break;case"linear_2s":N=2e3;break;case"linear_3s":N=3e3;break;case"linear_4s":N=4e3;break;default:N=1e3;break}return await new Promise(Bn=>setTimeout(Bn,N)),await xr(an,oe,me)}}throw at}},st,Hc={...t,meteredOperationId:T},Uc=typeof t.tenantId=="string"?t.tenantId:void 0,Bc=h?_(h):void 0;try{Bc==="managed_pricing"&&f?st=await pr({hub:f,tenantId:Uc??p,meteredOperationId:T},{plugin:o,cache:ud(o),operation:T}):s&&(st=await s(Hc,"endpoint"))}catch(q){if(q instanceof we)throw h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await Yo(u,{tenantId:q.tenantId??p,plugin:q.plugin,connectUrl:q.connectUrl,encryptDataAtRest:R,kek:R?b:void 0}),q;if(q instanceof I){h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await fa({error:q,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:b,plugins:k,multiTenancy:P})}catch(oe){throw oe instanceof I&&await Yo(u,{tenantId:oe.tenantId??p,plugin:oe.pluginId,connectUrl:oe.connectUrl,encryptDataAtRest:R,kek:R?b:void 0}),oe}}throw q}if(!C?.before&&!C?.after){let q=await xr(0,{...t,key:st},L);return await H?.(),h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),q}let Ci={...t,key:st},Un=C.before?await C.before(Ci,L):{ctx:Ci,args:L,continue:!0,passToAfter:void 0};if(Un.continue===!1)return;let Ti=await xr(0,Un.ctx,Un.args);return await C.after?.(Un.ctx,Ti,Un.passToAfter),await H?.(),h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),Ti};r[U]=O}else if(E&&typeof E=="object"){let C={};Qo({endpoints:E,hooks:ee,ctx:t,tree:C,pluginId:o,errorHandlers:i,currentPath:[...a,U],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:R}),r[U]=C}}}var fe={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},dd=/^\$+date$/;function ka(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!dd.test(t)?null:typeof e[t]=="string"?t:null}function en(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(en);let n=ka(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,en(r)])):e}function nn(e){let n=ka(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw F(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(nn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,nn(r)])):e}async function Xo(e,n,t){let r=Object.hasOwn(fe,n.method)?fe[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(fe).join(", ")}`);Ze(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function pd(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function ei({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(pd(a)){let c=s,l=async u=>{let d=(g,f)=>a.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let c={};ei({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function wa(e){return e&&typeof e=="object"?e:{}}async function Ca(e,n){return Z({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=wa(t).workflows;return Array.isArray(r)?r:[]}})}async function Ta(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>wa(t).workflow})}async function Pa(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function va(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Ra(e,n){return S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function ni(e){return e&&typeof e=="object"?e:{}}async function Aa(e,n){return Z({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ni(t).runs;return Array.isArray(r)?r:[]}})}async function xa(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=ni(t).runs;return Array.isArray(r)?r:[]}})}async function Ia(e,n){return Z({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>ni(t).run})}async function ti(e,n,t){await S({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Sa=(e,n)=>ti(e,"approve",n),_a=(e,n)=>ti(e,"deny",n),Ea=(e,n)=>ti(e,"cancel",n);function Oa(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?xa(t(),{workflowId:r.workflowId,tenantId:n}):Aa(t(),{tenantId:n}),get:r=>Ia(t(),{runId:r,tenantId:n}),approve:r=>Sa(t(),{runId:r,tenantId:n}),deny:r=>_a(t(),{runId:r,tenantId:n}),cancel:r=>Ea(t(),{runId:r,tenantId:n})}}function Ma(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Pa(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>Ca(t(),{tenantId:n}),get:o=>Ta(t(),{workflowId:o,tenantId:n}),run:(o,i)=>Ra(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:Oa(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>va(t(),{workflowId:o,tenantId:n,name:i})}}function gd(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await da({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function fd(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let c=Object.hasOwn(fe,a)?fe[a]:void 0;if(!c)return s;let l=s;return async(...u)=>(Ze(`${e}.db.${r}.${a}`,c),l.apply(i,u))}});return t}function yd(e,n,t,r,o){return e?Ir(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function ri(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>yn(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=gd(t,f.id,u,d);if(h?.entities){let H={};for(let[M,Ie]of Object.entries(h.entities)){let Hn=t?Ir(t.db,b,M,h.version,Ie,l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o??""}:void 0):yd(void 0,b,M,h.version,Ie);H[M]=Hn}g[f.id].db=H,p[f.id].db=fd(f.id,H)}let k=f.options,P=f.authConfig,R;if(t&&o&&k?.authType){let H=P?.[k.authType]?.account??[];R=B({authType:k.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:H,ensureProvisioned:d}),p[f.id].keys=R}let U={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...R?{keys:R,authType:k?.authType}:{},tenantId:u,...l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o}:{},...c?{hub:c}:{}},E=f.endpoints??{},ee=f.hooks,C={...i,...f.errorHandlers},T={},O=f.options?.permissions;Qo({endpoints:E,hooks:ee,ctx:U,tree:T,pluginId:f.id,errorHandlers:C,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:O,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy,encryptDataAtRest:l?.encryptDataAtRest===!0}),Object.keys(T).length>0&&(p[f.id].api=T),U.endpoints=T;let L=f.webhooks??{},ne=f.webhookHooks;if(Object.keys(L).length>0&&!Oi(k?.authType)){let H={};ei({webhooks:L,hooks:ne,ctx:U,webhooksTree:H,keyBuilder:f.keyBuilder}),p[f.id].webhooks=H,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=pa(c,u),p.workflows=Ma(c,u),p}function Da(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=W({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var md=3e4;function yr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function hd(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function bd(e,n){return`${yr(e)}/${hd(n)}`}function kd(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var oi=Symbol("cloudRequestTimeout");async function G(e,n,t,r){let o=vn(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??md,s=new AbortController,c,l=new Promise(g=>{c=setTimeout(()=>{s.abort(),g(oi)},a)}),u;try{let g=i(bd(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return oi;throw h}),f=await Promise.race([g,l]);if(f===oi)throw new w(0,"internal_error","Cloud request timed out");u=f}finally{clearTimeout(c)}let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw kd(u.status,p);if(p===void 0)throw new w(u.status,"internal_error","Invalid or empty response body from runtime");return p}var z={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var wd=new Set(["keys","webhooks"]),Cd=new Set(["chats","workflows"]),ii=new Set(["then","catch","finally"]);function ye(e){return typeof e=="function"?e():Promise.resolve(e)}function Ha(e,n,t,r){let o=async(...i)=>{let a=await ye(e);return(await G(a,"POST",z.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||ii.has(a)))return Ha(e,n,t,[...r,a])}})}function Td(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||ii.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(fe,a)?fe[a]:void 0;if(s)return async(...c)=>{Ze(`${t}.db.${o}.${a}`,s);let l=await ye(e),u=await G(l,"POST",z.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:en(c)});return nn(u.data)}}})}})}function mr(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||ii.has(o))){if(Cd.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return Ha(n.transport,n.tenantId,o,[]);if(a==="db")return Td(n.transport,n.tenantId,o);if(typeof a=="string"&&wd.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function hr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return ye(e).then(t=>G(t,"POST",z.connectLinks,n))}},tenants:{create:n=>ye(e).then(t=>G(t,"POST",z.tenants,n)),list:()=>ye(e).then(n=>G(n,"GET",z.tenants)),get:n=>ye(e).then(t=>G(t,"GET",z.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>ye(e).then(t=>G(t,"GET",`${z.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>ye(e).then(t=>G(t,"POST",z.disconnect,n)),permissions:{get:n=>ye(e).then(t=>"id"in n?G(t,"GET",z.permission.replace(":id",encodeURIComponent(n.id))):G(t,"POST",z.permissionLookup,{token:n.token}))}}}var Re=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function tt(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new Re(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new Re(e,{request_id:r,...i}):new Re(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var Pd=3e4,vd=new Set(["GET","HEAD","PUT","DELETE"]),Rd=/^[a-z][a-z0-9-]{0,31}$/;function tn(e,n){if(!Rd.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function rn(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function A(e,n){return`${e}/${encodeURIComponent(n)}`}async function br(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??Pd),l={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(l["corsair-version"]=e.apiVersion),o.idempotencyKey&&(l["idempotency-key"]=o.idempotencyKey),o.requestId&&(l["x-corsair-request-id"]=o.requestId);let u;try{u=await i(`${e.baseUrl}${t}`,{method:n,headers:l,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw tt(u.status,p,u.headers);if(p===void 0&&u.status!==204)throw tt(u.status,void 0,u.headers);return p}catch(d){if(o.signal?.aborted||d instanceof Re)throw d;let p=vd.has(n),g=u?p?!0:void 0:p||!!o.idempotencyKey;throw tt(u?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},u?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function si(e,n){tn(n,"withInstance");let t=(s,c,l,u)=>br(e,s,c,l,u),r=(...s)=>[n,...s].join(":"),o=s=>rn({...s,instance:n}),i=s=>`${A("/instances",n)}${s}`,a=s=>`${A("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",A("/tenants",r(s)),void 0,c),update:(s,c,l)=>t("PATCH",A("/tenants",r(s)),c,l),delete:(s,c)=>t("DELETE",A("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/access",r(s)),void 0,c),set:(s,c,l)=>t("PUT",A("/access",r(s)),c,l),revoke:(s,c)=>t("DELETE",A("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,l)=>t("GET",A("/connections",r(s,c)),void 0,l),delete:(s,c,l)=>t("DELETE",A("/connections",r(s,c)),void 0,l)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/integrations",r(s)),void 0,c),put:(s,c,l)=>t("PUT",A("/integrations",r(s)),c,l),delete:(s,c)=>t("DELETE",A("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${A("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${A("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,l)=>t("PUT",`${A("/integrations",r(s))}/oauth-app`,c,l),delete:(s,c)=>t("DELETE",`${A("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",A("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",A("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,l)=>t("POST",`${A("/webhooks",r(s))}/rotate-secret`,c,l),deliveries:{list:(s,c={},l)=>t("GET",`${a(s)}${rn(c)}`,void 0,l),get:(s,c,l)=>t("GET",A(a(s),c),void 0,l),retry:(s,c,l)=>t("POST",`${A(a(s),c)}/retry`,void 0,l)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function ai(e){let n=(t,r,o,i)=>br(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${rn(t)}`,void 0,r),create:(t,r)=>(tn(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(tn(t,"instances.get"),n("GET",A("/instances",t),void 0,r)),update:(t,r,o)=>(tn(t,"instances.update"),n("PATCH",A("/instances",t),r,o)),delete:(t,r)=>(tn(t,"instances.delete"),n("DELETE",A("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${rn(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${rn(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",A("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",A("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",A("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${A("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var Ua="default",Ad="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",xd=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function ci(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!xd.has(t))throw new Error(Ad)}})}function Ae(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function Id(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Fn(n),n}function Ba(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function Sd(e,n){let t=hr(e);return{ok:()=>Ae("manage.ok"),tenants:t.tenants,plugins:{list:()=>Ae("manage.plugins.list"),get:()=>Ae("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??Ua})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Ae("manage.connect.resolve"),oauthCallback:()=>Ae("manage.connect.oauthCallback")},disconnect:t.disconnect}}function _d(e,n){let t=Sd(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return mr(n.plugins,{transport:e,tenantId:a})},get keys(){return Ae("keys")},get permissions(){return Ae("permissions")},manage:t};let r=mr(n.plugins,{transport:e,tenantId:Ua}),o={manage:t,get keys(){return Ae("keys")},get permissions(){return Ae("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function Fa(e){return _d({baseUrl:Id(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function Ed(e){let n=yr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function Od(e){let n=await G({...e,baseUrl:Ed(e.baseUrl)},"GET",z.instances),t=new Map;for(let r of n.instances)Fn(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function Md(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=vi(n),r=e.url?.trim()||Ri(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");Fn(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(yr(e.managementUrl?.trim()??"")||void 0)??(t?Ai(r,t):null);a&&Fn(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function l(g){return g&&c===g&&(c=null),c||(c=Od(o).catch(f=>{throw c=null,f})),c}async function u(g){let f=l(),b=(await f).get(g)??(await l(f)).get(g);if(b)return b;let k=[...(await l()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=hr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...ai(s),...p}:ci(p),withInstance:g=>{let f=s?si(s,g):ci(),h=async()=>({...o,baseUrl:await u(g)}),b=hr(h),k={withTenant(P){if(!P)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return mr(void 0,{transport:h,tenantId:P})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:ci(k)}}}var Dd="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function La(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${Dd}`),t):n}var Hd=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),Ud=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),kr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),Bd=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),Na=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Fd=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),Ld=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function Nd(e,n){if(e instanceof w)return e;if(e instanceof I)return Bd(e.pluginId||n);if(e instanceof Pn)return Na("readonly");if(e instanceof le)return e.reason==="pending"?Fd():Na(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return Ld(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var $d=new WeakMap,$a=new WeakMap,Wd=512;function Wa(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function qd(e,n,t){if(n.size<=Wd)return;let r=$a.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function jd(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw F("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=Wa($d,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),qd(e,o,r),{client:a,tenantId:r}}function Kd(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function qa(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...qa(o,[...n,r]));return t}function ja(e){let n={};for(let t of e.plugins)n[t.id]=qa(t.endpoints??{});return n}async function ui(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw Hd(t.plugin);let{client:o,tenantId:i}=jd(e,n,t.tenant),a=i?Wa($a,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw Nd(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function Ka(e,n,{plugin:t,op:r,tenant:o,args:i}){return ui(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=Kd(s?.api,r);if(!c)throw Ud(t,r);return c(i??{})})}function on(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function rt(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var za=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>x(200,Ft())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(rt(n),x(200,await An(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(rt(t),x(201,await $t(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(rt(t),x(200,await Nt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>x(200,await Rn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>x(200,await Lt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>x(200,await Wt(e,on(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(rt(t),x(200,await ro(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?x(200,await io(e,t)):x(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=on(r,o.tenantId);return x(200,await jt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>x(200,await Kt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>x(200,await Zt(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=on(t,n.tenantId)??"default",o=e.database?await Vo(e.database,r,void 0,void 0,e.encryptDataAtRest?e.kek:void 0):null;return x(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=on(t,r?.tenantId)??"default";return e.database&&await ma(e.database,o,void 0,r?.plugin,e.encryptDataAtRest?e.kek:void 0,e.encryptDataAtRest),x(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=on(t,r.tenantId);return x(200,await qt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw kr();return x(200,{plugins:ja(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw kr("/db");rt(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw F("args must be an array");let c=on(i,r.tenant),l=nn(s.args??[]),u=await ui(e,n,{plugin:r.plugin,tenant:c},d=>Ga(t,()=>Xo(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},l)));return x(200,{data:en(u)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw kr();let s=o??{},c=on(i,r.tenant),l=await Ga(t,()=>Ka(e,n,{plugin:r.plugin,op:r.op,tenant:c,args:s.args}));return x(200,{data:l})}}];(()=>{let e=new Set;for(let n of za){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Zd(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function Gd(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function zd(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await ur(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var Jd="/api/corsair",Za=new Set(["open","cautious","strict","readonly"]);function Ga(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!Za.has(t))throw F(`Unknown permission mode "${t}" \u2014 expected one of ${[...Za].join(", ")}`);return Ht(t,n)}function j(e,n={}){let t=n.basePath??Jd,r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=v(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw _n(r);let l=new URL(s.url),u=Gd(l.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await Ye(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return x(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of za){if(g.method!==d)continue;let f=Zd(g.pattern,u);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return x(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await zd(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Ue(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,s);if(u)return u}if(c instanceof w)return de(c);let l=c instanceof Error?c.message:"Internal server error";return x(500,{error:"internal_error",message:l})}}}function Vd(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function Yd(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Qd(e,n,t){let r=[],o=0,i=e();try{let a=await cr(()=>i.next(),t);for(;a.done!==!0;){let s=Yd(a.value);if(o+=s.byteLength,o>n)throw _n(n);r.push(s),a=await cr(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var Ja=!1;function Xd(){Ja||(Ja=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function ep(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Xd(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await Qd(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw _n(r);return typeof i=="string"?i:i}function Y(e){e.resume?.()}async function Fe(e,n={}){let t=Vd(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!np.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)a.append(l,d);else a.set(l,u);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await ep(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function Q(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var np=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function Va(e,n){let t=j(e,n);return async(r,o,i)=>{try{let a=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await Q(o,de(a)),Y(r);return}Y(r),i(a)}}}function tp(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function rp(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=tp(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function Ya(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Qa(e,n){let t=j(e,n);return async(r,o)=>{rp(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Fe(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await Q(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await Q(o.raw,de(a)),Y(i);return}throw Y(i),a}}}function Xa(e,n){let t=j(e,n);return r=>t(r.req.raw)}function ec(e,n){let t=j(e,n);return{GET:t,POST:t,OPTIONS:t}}function nc(e,n){let t=j(e,n);return async(r,o)=>{try{let i=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),Y(r);return}if(i instanceof w){await Q(o,de(i)),Y(r);return}console.error("[corsair] management handler failed:",i),await Q(o,x(500,{error:"internal_error"})),Y(r)}}}function wr(e,n){let t=j(e,n);return r=>t(r.request)}function tc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function rc(e,n){let t=wr(e,n);return{loader:t,action:t}}function oc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function ic(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function sc(e,n){let t=j(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Fe(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await Q(r.node.res,de(i)),Y(o);return}throw Y(o),i}}}function ac(e,n){return j(e,n)}function cc(e){let n={[ot]:e};return{ok:Ft,tenants:{list:()=>An(e),create:t=>$t(e,t),get:t=>Nt(e,t)},plugins:{list:()=>Rn(e),get:t=>Lt(e,t)},connectionStatus:{get:t=>Wt(e,t?.tenantId)},permissions:{get:t=>Ds(e,t)},connect:{createLink:t=>jt(n,e,t),resolve:t=>Kt(n,e,t),oauthCallback:t=>Zt(n,e,t)},disconnect:t=>qt(e,t)}}async function uc(e,n,t,r,o="pending",i){if(i==="")throw new Error("encryptDataAtRest requires kek");if(!e)return null;try{let a=un(),s=new Date,c=i?pt(r,await Nn(e.db,n,i)):r;return await e.db.insertInto("corsair_events").values({id:a,created_at:s,updated_at:s,account_id:n,event_type:t,payload:c,status:o}).execute(),a}catch(a){return console.warn("Failed to log event:",a),null}}async function op(e,n,t,r="pending"){if(e.encryptDataAtRest&&!e.kek)throw new Error("encryptDataAtRest requires kek");try{let o=await e.$getAccountId();return uc(e.database,o,n,t,r,e.encryptDataAtRest?e.kek:void 0)}catch(o){return console.warn("Failed to log event:",o),null}}import*as dc from"https";import*as Cr from"querystring";var ip=["expires_in","refresh_token_expires_in"];function lc(e){let n={...e};for(let t of ip){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function sp(e){try{return lc(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=Cr.parse(e);return!n.access_token&&!n.error?null:lc({...n})}function At(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let u=Cr.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=dc.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=sp(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function pc(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(En({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new I(o,"oauth_2");let l=await S({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:ln}),u=await On(t,l,s);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function gc(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function fc(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new I(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>Qe(e.keys,r,async()=>(await pc(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,a=l=>Qe(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&En({accessToken:u,expiresAt:d}))return u;if(!p)throw new I(n.plugin,"oauth_2");let g=await gc({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await On(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:s,expiresAt:c})?s:a(!1)}var yc="  ";function ae(e){let n=e;return n._def??n.def??{}}function ce(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function se(e){return e.innerType??e.schema??e.out??e.in}function hc(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return se(e)}}function bc(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Pr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Mn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function kc(e,n){return e.description??n.description}function cp(e){let n=e;for(;n;){let t=ae(n),r=kc(n,t);if(r)return r;let o=ce(t);if(fi(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=hc(t,o);continue}break}}function fi(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function X(e){let n=ae(e),t=ce(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Mn(n)[0]??"unknown");case"ZodEnum":return Mn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=se(n);return r?X(r):"unknown"}case"ZodNullable":{let r=se(n);return`${r?X(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=se(n);return r?X(r):"unknown"}case"ZodArray":{let r=bc(n);if(!r)return"unknown[]";let o=ae(r),i=ce(o)==="ZodUnion",a=X(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Pr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=ce(ae(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${X(s)}`}).join(", ")} }`}case"ZodUnion":return Mn(n).map(r=>X(r)).join(" | ");case"ZodIntersection":return`${X(n.left)} & ${X(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=hc(n,t);return r?X(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function xe(e){let n=ae(e),t=ce(n),r=kc(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Mn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Mn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=bc(n);return{kind:"array",optional:!1,description:r,items:o?xe(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Pr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=xe(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Mn(n);for(let i of o){let a=ae(i);if(ce(a)==="ZodObject")return{...xe(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function GP(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(u=>u.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);return!c&&!l?null:{input:l?.input?xe(l.input):null,output:l?.output?xe(l.output):null,description:c?.description}}var yi=["equals","contains","startsWith","endsWith","in"],up=["equals","gt","gte","lt","lte","in"],lp=["equals"],dp=["equals","before","after","between"];function wc(e){let n=ae(e);switch(ce(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=se(n);return r?wc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function mi(e){let n=ae(e),t=ce(n);if(fi(t)){let i=se(n);return i?mi(i):{}}if(t!=="ZodObject")return{};let r=Pr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=wc(a);s==="string"?o[i]={type:"string",operators:yi}:s==="number"?o[i]={type:"number",operators:up}:s==="boolean"?o[i]={type:"boolean",operators:lp}:s==="date"&&(o[i]={type:"date",operators:dp})}return o}function Cc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function di(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&di(o,i,t)}}function pi(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function gi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];pi(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&gi(o,i,t)}}function hi(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return pi(a)?[i]:null;if(a!==null&&typeof a=="object"&&!pi(a)){let s=hi(a,r);if(s!==null)return[i,...s]}return null}function Tc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var pp=new Set(gt);function sn(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return pp.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:sn(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return gi(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return di(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];gi(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];di(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function Le(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function gp(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function li(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function zP(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=Cc(f,p);if(h){let[b,k]=h,P=mi(k),R=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${yi.join(", ")}]`];for(let[U,E]of Object.entries(P))R.push(`  ${U}?: ${E.type}  [${E.operators.join(", ")}]`);return R.push("}"),R.join(`
+`)}}}return li(sn(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(a.webhooks){let d=hi(a.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=Le(a.webhookSchemas,p.toLowerCase()),f=g?.response?X(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${Tr(Dn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${Tc(o,d)}`),h.join(`
+
+`)}}return li(sn(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${Tr(Dn(l.input))}`),l?.output&&u.push(`output ${Tr(Dn(l.output))}`),u.join(`
+
+`)}}}return li(sn(e),"Path not found. Available operations")}function mc(e){let n=e;for(;;){let t=ae(n),r=ce(t);if(fi(r)){let o=se(t);if(!o)return n;n=o;continue}return n}}function Dn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=mc(e),t=ae(n);if(ce(t)==="ZodObject"){let o=Pr(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ae(s),l=ce(c),u=l==="ZodOptional"||l==="ZodNullable",d=mc(s),p=cp(s);i.push({key:a,optional:u,type:X(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:X(n)}}function Tr(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=yc.repeat(n+1),r=yc.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function fp(e,n){let t=sn(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=gp(u,n),g=Le(r.endpointMeta,p),f=Le(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Dn(f?.input),output:Dn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],a=sn(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let u of a){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=hi(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=Le(r.webhookSchemas,b.toLowerCase()),P=k?.response?X(k.response):void 0;i.push({path:u,description:k?.description,payload:Dn(k?.payload),responseType:P,usageExample:Tc(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let s=[],c=sn(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let P=Cc(l,b);if(!P)continue;let[R,U]=P,E=mi(U),ee=Object.entries(E).map(([C,T])=>({field:C,type:T.type,operators:T.operators}));s.push({path:u,entityName:R,filters:[{field:"entity_id",type:"string",operators:yi},...ee]})}return s.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as Pc}from"crypto";async function yp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Pc(),o=Pc(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as mp}from"crypto";var vr="https://graph.microsoft.com/v1.0",bi=2e4,hp=60;async function bp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${vr}/subscriptions`,{headers:r,signal:AbortSignal.timeout(bi)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${vr}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(bi)}).catch(()=>{})))}}catch{}let o=mp(),i=new Date(Date.now()+hp*6e4).toISOString(),a=await fetch(`${vr}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(bi),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function vc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function kp(e,n){let t=vc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function wp(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Rc(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Ac(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function it(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function Cp(e){return it(e.body)}function xc(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Rr(Array.isArray(r)?r:[r])}function Ic(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Rr(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=xc({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=it(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Rr([a?.validationToken])??null}function Tp(e){if(Ic(e))return!0;let n=it(e.body??e.payload);return Rc(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Rr(e){for(let n of e){let t=Ac(n);if(t)return t}}function Pp(e){let t=it(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var ot=Symbol.for("corsair:internal");function Oc(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&Ba(e.hub))return Fa(e);let n=e.database?Ii(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?Da(e.plugins,n,t):gr(!!n,!!t),o=La(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?wt(e.hub):void 0,encryptDataAtRest:e.encryptDataAtRest===!0},a=Is(n),s=cc(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=ri(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[ot]:i})},keys:r,permissions:a,manage:s},{[ot]:i});return Sc(u,i.hub),Ec(u,i.hub),u}let c=ri(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:a,manage:s,[ot]:i});return Sc(l,i.hub),Ec(l,i.hub),l}function Sc(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-M43UGVNM.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function vp(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var _c=globalThis.__corsairTunnels??=new Set,Rp=1e3,Ap=3e4;function xp(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??Rp,r=e.maxDelayMs??Ap,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function Ec(e,n){if(!vp(n))return;let t=n.projectApiKey;if(_c.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}_c.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Sr;xp({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${_r}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var Ip={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},ki=Ip;async function xt(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=_i(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Np(e,s.plugins,n),l={...s,database:s.database},u=l.database.db;await qp(l.database,i);let d=await jp(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Gp(e,c,n.credentials,l,o,i);let p=await Jp(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Oc({plugins:s.plugins,database:u,kek:s.kek,multiTenancy:!0,...s.encryptDataAtRest?{encryptDataAtRest:!0}:{}}).withTenant(c.tenantId);await Vp(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function wi(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...K[n][t],...r])}function Lp(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=_(o);if(!i)continue;let a=wi(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function Np(e,n,t){let r=Ei(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Lp(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Dc(e,n){return _e(e)?n===0?!0:Object.values(e).every(t=>Dc(t,n-1)):!1}function $p(e){return Dc(e,4)}var Wp=Bi;function Ar(e){if(e instanceof Dp){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Fp?Ar(r):"unknown";return n}return e instanceof Op?`${Ar(e.unwrap())} | null`:e instanceof Hp?`${Ar(e.unwrap())} | undefined`:e instanceof Ep?e.options.join(" | "):e instanceof Bp?"string":e instanceof Mp?"number":e instanceof Sp?"boolean":e instanceof _p?"date":e instanceof Up?"jsonb":"unknown"}async function qp(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??xi();for(let[i,a]of Object.entries(Wp)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Ar(a),null,2)}`)}}}async function jp(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,l=_(s),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&u?W({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&B({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...K[l].integration,...d],accountFields:r?[...K[l].account,...p]:[]})}return a}function Kp(e){if(!_e(e))return;let n=e.keys;return _e(n)?n:void 0}function Zp(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Gp(e,n,t,r,o,i){let a=Kp(e),s=n.provisionAccounts?Zp(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(k=>k.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=_(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=wi(u,d,"integration"),g=wi(u,d,"account"),f=a?.[c],h=s?.[c],b=_e(h)?h.keys:void 0;for(let[k,P]of Object.entries(l))if(P){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let R=te(f,`set_${k}`);if(!R){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await R(P),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let R=te(b,`set_${k}`);if(!R){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await R(P),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var Mc=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function zp(e,n,t,r,o,i,a,s,c){let l=[],u=[];for(let p of o){if(Mc.has(p))continue;let g=te(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(Mc.has(p))continue;let g=te(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function Jp(e,n,t,r){let o=new Set;for(let i of e.values())await zp(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Vp(e,n,t,r,o){if(!$p(ki)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=ki,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=_e(e)?e[s]:void 0,u=_e(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=_e(u)?u[d]:void 0;await te(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{Fi as a,Ee as b,we as c,ft as d,yt as e,mt as f,ln as g,Li as h,Er as i,Fr as j,$n as k,zi as l,Ji as m,Oe as n,We as o,Ce as p,pn as q,gn as r,Me as s,Nr as t,Yi as u,jn as v,Te as w,Kn as x,$r as y,wt as z,$ as A,Ct as B,fn as C,W as D,B as E,es as F,ns as G,xt as H,Gp as I,He as J,qr as K,hn as L,kn as M,Kr as N,Rt as O,ds as P,Ke as Q,V as R,Zr as S,zn as T,ys as U,Cu as V,It as W,dy as X,bs as Y,ks as Z,ws as _,Cs as $,St as aa,Gr as ba,le as ca,Et as da,Ot as ea,Pn as fa,Ht as ga,vn as ha,eo as ia,As as ja,Ut as ka,Ze as la,w as ma,ao as na,co as oa,Gt as pa,uo as qa,xn as ra,In as sa,zt as ta,Jt as ua,Jn as va,lo as wa,po as xa,Vt as ya,Vn as za,Yt as Aa,Qt as Ba,Be as Ca,Sn as Da,Ns as Ea,ho as Fa,bo as Ga,ze as Ha,Xn as Ia,et as Ja,ir as Ka,Co as La,nt as Ma,xl as Na,Ol as Oa,Hl as Pa,Vs as Qa,Ys as Ra,ar as Sa,Qs as Ta,Xs as Ua,Je as Va,Ve as Wa,Ro as Xa,Ao as Ya,xo as Za,Io as _a,So as $a,Ye as ab,I as bb,_o as cb,ia as db,lr as eb,Oo as fb,dr as gb,pr as hb,ca as ib,Mo as jb,Do as kb,Ho as lb,Uo as mb,Bo as nb,Fo as ob,Lo as pb,No as qb,$o as rb,Wo as sb,qo as tb,jo as ub,Ko as vb,Zo as wb,Go as xb,Xe as yb,fe as zb,en as Ab,nn as Bb,Xo as Cb,Re as Db,Md as Eb,j as Fb,Va as Gb,Ya as Hb,Qa as Ib,Xa as Jb,ec as Kb,nc as Lb,tc as Mb,rc as Nb,oc as Ob,ic as Pb,sc as Qb,ac as Rb,uc as Sb,op as Tb,At as Ub,fc as Vb,GP as Wb,sn as Xb,zP as Yb,Tr as Zb,fp as _b,yp as $b,vr as ac,bp as bc,vc as cc,kp as dc,wp as ec,Rc as fc,Ac as gc,it as hc,Cp as ic,xc as jc,Ic as kc,Tp as lc,Rr as mc,Pp as nc,ot as oc,Oc as pc,vp as qc,xp as rc};